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Abstract 

We consider the problem of getting a computer to follow reasoning conducted in dynamic 
logic. This is a recently developed logic of programs that subsumes most existing first-order 
logics of programs that manipulate their environment, including Floyd's and Hoare's logics of 
partial correctness and Manna and Waldinger's logic of total correctness. Dynamic logic is more 
closely related to classical first-order logic than any other proposed logic of programs. This 
simplifies the design of a proof-checker for dynamic logic. Work in progress on the 
implementation of such a program is reported on, and an example machine-checked proof is 
exhibited. 
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Introduction 

The logical language. 

Our objective is to be able to discuss programs with a computer. The prerequisites are a 
language for holding the conversation in, and reliable criteria for following a line of reasoning 
expressed in this language. We adopt a simple language having just four basic constructs. 
Three of these constructs come from ordinary logic; they are function symbols, predicate 
symbols, and logical connectives. (We lump constants and variables together with the zeroary 
function symbols.) The fourth construct, while not a familiar one in logic, is nevertheless one 
that occurs in everyday conversations about programs; it is the notion of "after executing 
program «." For example we may say in ordinary conversation, "After executing the program 
Xs-1, X is equal to L" 

While these four constructs may not seem very much to go on, they are in fact sufficient 
for almost any "first-order" conversation about the input-output behavior of programs. They 
may express such diverse concepts as partial correctness, termination, equivalence, determinism 
versus nondeterminism, totality, reversibility of a process, accessibility of states, weakest 
antecedents, strongest consequents, weakest and strongest invariants, and convergents. They 
also shed new light on the axioms relevant to quantifiers in first-order predicate calculus by 
treating them from the programmer's point of view rather than the logician's. 

We abbreviate "after executing program a" to Ca], so that the observation of the first 
paragraph condenses to [X:=11X=1. (We have found it convenient in conversation to pronounce 
tml as "box a.") We shall later find useful the dual concept -*[a3-» which we write <or>, 
pronounced "diamond a." The notation is borrowed from modal logic. Dynamic logic is more 
intimately connected with modal logic than one might at first suppose; the connection is 
discussed in more detail in section 3.2 of [21]. Fischer and Ladner C63 demonstrate the 



^ connection between various restrictions of dynamic logic and the classical systems K, T, S4 and 

S5 of modal logic. We call [«] and <o> modalities (respectively box and diamond modalities), 
and formulae of the form C«]P and <a>P modal formulae. We shall call a quantifier-free logic 
augmented with such modalities a dynamic logic. Syntactically, modalities behave exactly like 
logical negation; they are placed in front of a formula, and their precedence is such that 
C«DPaQ is parsed (C«]P)aQ, just as -PaQ would have been parsed (-P)aQ. 

The progr amming language 

In order to understand the meaning of a formula such as -*X:=l]faJse, we first need a precise 
account of X:=L We shall think of programs solely in terms of their effect on the slate of the 
world. A state is defined by the values taken on by the function and predicate symbols of the 
language in some domain. (A logician would call a state an interpretation.) We call the set of 
all possible states (keeping the domain fixed) the universe. Thus a universe is defined by the 
available function and predicate symbols and the choice of domain. 

We could restrict our attention to deterministic programs, permitting us to think of them as 
functions from states to states. As we shall see later however, reasoning nondeterminislically 
^ about deterministic programs can simplify the argument. Hence we shall allow for 

nondeterministic programs by capturing the effect of a program on a universe as a binary relation 
on that universe. This of course means that we will be able to discuss nondeterministic 
programs in general. However, the question of what first-order Tacts one wants to assert 
about nondeterministic programs is presently the subject of much discussion in the literature (see 
CS3 in particular), and we shall avoid that issue in this paper beyond observing that dynamic logic 
as presented here can express many useful ideas about nondeterministic programs. 

In treating programs as binary relations we shall make use of the usual notation that 3a$ is 
true just when 3 and # are related by a. It is convenient to identify the relation a as its graph, 
the set of pairs of stales related by a. 

Programmin g co^n^jrucis 

The programs we want to discuss have five constructs. These constructs, while not all 
entirely conventional, have been chosen primarily for the ease with which one can discuss 
programs written using them. 



^—\ 



(i) Assignments. X:=l is an instance of an assignment, as is C(l,K):=C(l,K)+A(l,J)xB(J,K). In 
general an assignment is a pair of terms (respectively the left-hand and right-hand sides of the 



assignment) of our logical language. (A term is an expression constructed solely from function 
symbols.) We shall take zeroary function symbols to be ordinary variables. Then when the 
left-hand term is simply a zeroary function symbol the assignment is simple variable assignment; 
for other left-hand sides we have array assignments. Formally, the simple variable assignment 
X^t, where t is an arbitrary term, is {(9,$)|X<j=t<j and otherwise 3=$}. (X* denotes the value 
of X in i % tj the value of t in S.) Array assignments are slightly harder to define; see [211 

(ii) Tests, Conditionals are usually introduced with "if-then-else," However the rules of 
reasoning (our axiom system) can be simplified by using a "smaller" notion of conditional, the 
test, which we shall use in conjunction with the next two constructs to synthesize if-then-else. 
X>0? is an instance of a test, as is J~OvPattern(J)=Text(K)?. In general a test P? is constructed 
from a formula P of the logical language. The idea of a test is that a computation may proceed 
past a test just when that test evaluates to true in the current environment, otherwise the 
computation must block (which for our purposes is equivalent to going into an infinite loop). 
Formally, the test P? is the restriction of the identity binary relation on the universe to those 
states satisfying P, i.e. {(9,3)|^P} 8 Most of what we say holds even for tests containing 
modalities, corresponding to the side-effect-free programming construct "if P would be the 
result of running a then,.." However we shall confine our examples to the more familiar 
modality-free variety, 

(ill) Alternation, Execution of o|jB means the execution of either one (but not both) of a' and 
0s the choice being made nondeterministically. Formally, the relation a\0 is the union of the 
relations a and fi. 

(iv) Sequencing. Execution of ®;0 means execution of first a then $. Formally, a;{3 is the 
composition of m and #. 

Using tests, alternation, and sequencing, we may express "if P then a else /3," where P is a 
formula and a and are programs, as P?;«hP?;$. In effect, P and iP act as "guards," to use 
Dijkstra's [S3 terminology. P?;cs can only be executed when P holds, and conversely for -»P?;0. 
Hence when P is true P?;a|-iP?;0 must be equivalent to a, and otherwise to $, which is the 
property "if P then a else j8" should have. 

(v) Iteration. Execution of a* means executing m zero or more times, the number of times 
being chosen nondeterministically. Formally, ®* is the reflexive transitive closure of a. 

Using tests, sequencing^ and iteration, we may express "while P do a" in much the same 
spirit m if-then-else) namely as (P;a)*pP. This permits a to be iterated for as long as P 



^ remains true. Moreover, the iteration may not terminate while P remains true, on account of 

the iP guarding the exit. (This usage of a guard at the end is not permitted in C53.) 

With these five constructs we can express any flowchart program that has decision boxes 
and manipulates arrays. This can be done without introducing additional variables. This 
follows from the fact that state transition diagrams can always be translated into equivalent 
regular expressions. This is not possible with assignments, sequencing, if-then-else and while- 
do [2], the difference having to do with the determinism of the latter. 

Quasi-programming constructs 

In addition to the five constructs for our programming language, we shall find two more 
constructs of interest, not in writing programs but in talking about them. 

(vi) Random assignment. X:=? is an instance of a random assignment, which 
nondeterministically assigns an arbitrary element of the domain to X. Consider the sense of 
CX:=?J(X<0VX»0). This says that no matter what element is assigned to X, after the assignment 
X will be either negative or non-negative. This captures what is meant by VX(X<0vX^0). 
/~v This demonstrates that we can introduce the ordinary quantifier VX into dynamic logic as just 

another modality CX:=?1 Though we shall adhere to the standard notations VX and 3X it should 
be understood that these stand respectively for CX:=?] and <X:=?>. 

< vii ) Converse, Execution of a" means the reverse execution of a. Formally, a~ is the 
converse of a, satisfying Sotf s fl a -$, This permils us l0 reason ejther forwards or backwards 
about a program's behavior. We mean this in the sense that (i) Co]P is a claim made before 
execution of a based on the claim P that is supposed to hold after execution of a (backward 
reasoning), and (ii) Co~3P is a claim made after the execution of a based on the claim P that is 
supposed to hold before execution of a (forward reasoning). We have not capitalized on 
converse as much as we would like in our work to date. 

Truth-value Semantics of Dynamic logic 

Now that we have settled on the programming language, we can return to the question of 
what ^CX:=l]false means, or more generally what any formula containing Co]P means. It is 
important here to realize the distinction between truth and validity. What we are about to 
define is the truth value of a formula of dynamic logic in a single state. This is to be 
O contrasted with, say, Hoare's notion of "P{o}Q," whose truth is not defined on a state-by-state 

basis but rather is defined for the whole universe, and so corresponds to the usual notion in 



logic of validity. 

In state 3, Cck3P is true just when P is true in every state # satisfying 3«$. That is, P is 
true no matter which state a terminates in when started in state 5. It follows that <a>P is 
true just when P is true in some state <J satisfying Sa$, that is, when it is possible for a to 
terminate and satisfy P if started in state 3. 

Expressiv e power of dynamic logic 

We may now show how dynamic logic may be used to express a variety of concepts. 

PCot>Q MPdMQ) 

Termination analogue N(P3<a>Q) 

of P<a>Q 
<xb0 NVX ( (<a>Y=X) e (<(3>Z=X) ) 

(This assumes that Y,Z are the respective output variables of a, (3. 

While this generalizes to programs with any finite set of output 

variables, it does not generalize to programs with arrays as output 

unless we introduce second order quant i tiers, } 
a deterministic t=VX{<a>Y=X d [a)Y=X) 

<As for equivalence, Y is the output variable of a,) 
a always halts fc<q> true 

aH hVX(<cT>YnX o ta"]Y=X) 

a onto fc<oT>true 

a halts in this state <a> true 

weakest antecedent MP 

strongest consequent <oT>P 

weakest invariant ta*]P Csee C9J for proof) 

strongest invariant <cT*>P " " " " 

convergent <ot N >P 

The reader wishing to pursue these concepts further is referred to [91 Some simple 
statements expressible in dynamic logic that do not fall into any of the above categories, and are 
not expressible in Hoare's partial correctness formalism or the total correctness formalism of 
Manna and Waldinger Q7] f are: 

"If you set Y to X*5 and then [Y:=X4-5;Y:=Y+2*] 
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add 2 to Y an indefinite <Y:=Y-1*>Y=X 

number of times then it is 
possible by repeatedly 
executing Y:*Y-1 to make Y=X" 

"If P holds then after Pota)<a~>P 

executing a we will be in a 
9tate accessible via a from 
some state satisfying P." 

All or the above concepts can be stated in a second order logic that permits explicit 
manipulation of states and/or programs as individuals, as in [3] where states can be quantified 
over, or CIO] where programs are terms. The interest in dynamic logic is that it achieves its 
expressive power using only first-order language. The advantage or keeping the language 
restricted in this way is that it is easier to completely axiomatize parts of the logic, though loops 
present an insurmountable obstacle to completeness as demonstrated in Theorem 16 of C211 

An axiom system for dynamic logic 

Before axiomatizing the programming language, let us begin with a sound complete axiom 
system Tor Hrst-order logic. A novelty or this system is that it separates into logical and non- 
logical components what are usually taken to be entirely logical rules and axioms, on the principle 
that facts about X:=? are program-specific facts. This permits a programmer to apply his 
intuition about programs to the problem or understanding the significance or each axiom. 

Log i ca I Ax i oms 

All tautologies of Proposi tional Calculus. 

to] (PdQ) d ([ Q ]P d to]Q) . (Axiom M) 

Logical Inferen ce Rules 

P, PdQ h Q . (Modus Ponens) 

P h MP (Necessitation; subsumes generalization, P H VxP ) . 

Non- logical A xioms 

VXP d pj (any term T; pj is P with T for X) 

P D VXP unless X occurs free in P 

Axiom M can be thought or as a claim about programs; it says that for all states S, if P 



implies Q in every state $ that can be reached from 3 by executing et, and if P holds in every 
state U similarly accessible from $ via a, then Q holds in every state $ accessible from S via a. 

The second inference rule (the rule of necessitation of modal logic) can be considered as an 
upper bound on the power of programs, which cannot falsify theorems. If P is a theorem then P 
is true in every state, including states accessible via a. 

In our system it is straightforward to prove as theorems the axioms of, say, Mendelson's 
system K Q8] (p. 57), and it should be clear that the second role subsumes the rule of 
generalization; in fact, if the only modalities allowed are those with values of the form X:=? 
then the rule of necessitation h the rule of generalization, and the theorems of this system 
coincide with the theorems of K. It is interesting to note that Mendelson manages to express as 
one axiom what we take two to express, namely our Axiom M and the second quantification 
axiom, The advantage of our decomposition of this axiom is that we get two axioms about 
quantifiers that serve respectively as a lower and an upper bound on what the binary relation 
X:=? may be. 

So far we have only given axioms for random assignments. Now let us axiomatize the four 
loop-free programming constructs. 

CP?JQ s PdQ 

CXs=tJP s P^ (see 121] for array assignment) 

[a|01P s MPa[0]P 

[aj0)P s ted tfilP 

Interestingly (but fairly obviously^ as demonstrated in [2I]) S the axiom system with these 
four new axioms remains sound, complete and effective. (It is possible to give further axioms to 
handle the converse operation, still preserving soundness, completeness and effectiveness. 
However we shall not make use of this in the following,) 

A derived rule 

We could at this point proceed with the discussion of our ultimate objective, the 
construction of a proof-checking program that would check proofs expressed in the above axiom 
system. Unfortunately the above system is too weak to permit reasonably succinct proofs; for 
example, it appears that 6 lines are needed to prove <X:=1>X=1 from the assumption 1-1 using the 
above system. In this section we explore a derived rule with an eye on strengthening the axioms 
and rules* In this respect we are emulating j.A, Robinson [22], who prescribed a new rule to 
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facihtate the construction of automatic theorem-provers. The constraints on a proof-checker 
are somewhat different from those of a theorem-prover, and the arguments for Robinson's 
resolution rule are not sufficiently compelling for us. In particular, the convenience of having a 
clause as the unit of information, which helps an automatic theorem prover organize the proof 
may be more hindrance than help in a proof-checker because the user may not have conceived his' 
proof m terms of clauses that are disjunctions of literals. This is not to say that we shall not 
make use of unification; indeed, unification is a most valuable tool in automated logic. 

We now give the details or the rule, which we call the Show Rule for lack of a more 
descriptive term. A proof step using it looks like 

Show S <ps> using TO {p0>, Tl <pl>, T2 {p2>, ... 

For the moment ignore the items inside braces { }. Ideally, we would like this rule to apply 
whenever the formulae TO, Tl, T2, .„ logically entail the formula S, a semantic characterization 
of the rule. Unfortunately that would lead to a non-effective proof-checker, since logical 
entailment is not even partially decidable for our language C91 Instead we resort to an effective 
syntactic characterization. This is where the items in braces enter the picture. The braces 
enclose "templates" which contain the prepositional content of the proof step, in the sense that 
each template is a prepositional "approximation" to the formula it follows. For example, we might 
say 

Show CXz=l|X:=2]X>0 < P Aq> using 1>0 <p>, 2>0 <q>. 

The template pAq refers to the result of expanding CX: = 1|X:=2]X>0 first to 
CX:=1]X>0aCX:=23X>0 and then to 1>0a2>0. It should be clear that the two uses of p in the 
templates refer to the same formula, 1>0, and similarly for the two uses of q. More generally, we 
shall require only that multiple occurrences of the same letter refer to unifiable formulae. 

We check this proof step in two phases, which can be done independently and in either order 
(or in parallel by two processors). One phase, called IDENTIFY, is to check that repetitions of 
the same letter can be justified. We do this by attempting to unify corresponding formulae. The 
other phase, called VERIFY, is to see whether the templates alone constitute a sound argument in 
modal prepositional logic. In this example all modalities were eliminated so that we were left 
with the argument 

Show pAq using p, q 
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which is in fact a sound argument of non-modal propositional logic. A situation where modal 
logic would help is: 

Show [U|V]Y>0 <Calt(8]p> 

using CU)X=rl {[cc]q>, X=1dMY>0 <q:>[f3]p>. 

Here we are dealing with "uninterpreted" programs U and V, a situation that arises when we are 
given a program about which we have previously proved some useful properties and whose code 
we no longer wish to be bothered with, (This situation arises frequently in the extended 
example of the next section but one.) In this case, knowing nothing about the programs U and V 
beyond the facts given, we could not expand them in the way we did with CX:=1], so they carry 
over to the templates. Here the argument of modal logic is: 

Show [aH0]p using totlq, q:>[0)p. 

This argument can readily be seen to follow if we apply Necessitation to q^[0]p to get 
tal(q^L(31p) an d hence Ea3q=>[a]C0]p. The rest is propositional reasoning. 

The IDENTIFY phase begins by determining what subformula each occurrence of a template 
letter refers to. This is done by systematically expanding the formula associated with the 
template containing the given letter until the formula can be matched to the template. Thus 
CU;V3[W3X=0 will match [a3C03p directly with a matched to U;V, b to W and p to X=0. However 
CU;V3X^0 will not match [a3C£3p directly but must first be expanded as [UXV3X=0. [V|W3X=0 
will not match pAq directly but must first be expanded as [V3X=0aCW3X=0. Once the formula 
matches the template, the subformula corresponding to each letter can immediately be 
determined. Then all the subformulae corresponding to occurrences of the same letter are 
checked for whether they can be unified. This may require further expansion; for example, 
attempting to unify CX:=13X>0 and W>0 involves eliminating the assignment modality to give 1>0, 
and instantiating W as 1, this latter step being performed by a unification algorithm. All 
instantiations necessary must be compatible with each other. 

Any formulae that fail to unify are put to one side while the remainder of the proof step is 
checked. When that is done, then the failed pairs are expressed as an equivalence and tested by 
a routine that checks for validity of quantifier-free Presburger arithmetic, in the hope that the 
formulae turn out to be equivalent on arithmetic grounds. (This together with the Rule of 
Convergence described in the next section is the only concession to domain-dependencies in the 
system.) 
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^ The VER,FY P hase is a satisfiability tester for modal prepositional logic. It begins by 

determining what applications of the Rule of Necessitate are sufficient to make the proof go 
through. Boxes are then eliminated Trom the formula by the appropriate generalization of the 
transformation <a>PA[«]Q -> <a>(P A Q), which preserves satisfiability for the intuitively 
obvious reason that Ca]Q acts only as a constraint on those worlds one might construct (in 
attempting to satisfy <*>P) that are accessible via a and satisfy P, namely that in any such world 
Q must be true, in our present implementation, we first eliminate all top-level prepositional 
letters by expressing the formula in conjunctive normal form and applying the Davis-Putnam 
algorithm for each of those letters. Then we convert the resulting formula involving only 
modalities to disjunctive normal form and apply the above transformation. Then the process is 
repeated on the arguments of the top-level diamond modalities. Though this approach can be 
inefficient, in practice on the kinds or formulae we encounter it is the most efficient of the 
methods we have tried. With all boxes eliminated, the satisfiability of the result no longer 
depends on the names of the diamonds; that is, <o>Pv</3>Q and <a>Pv<o>Q are equally 
satisfiable. Indeed, satisfiability of the whole is preserved if <o>P is replaced by true when P is 
satisfiable and false when not. Thus we can proceed recursively, working up Trom the lowest 
diamonds to determine satisfiability of progessively larger portions of the formulae. 

f Axioms for programs with loops 

For programs with loops we have the following axioms and rules. 

<a n >P o <o*>P Axioms of Intent (one for each n) . 
PdMP h P 3 [«*]P Rule of Invariance. 

n>z a P a Q(n) d <a>3w(z<w<n a Q(u)) 

H n*z a Q(n) o <a*>HPA3w(zswSnAQ(n)) v Q(z)) 
Rule of Convergence 

These axioms and rules are explained and justified in more detail in [211 The first says that 
if a can halt in some number of steps then a* can halt. The second says that if a leaves P 
unchanged, then so does a*. (Observe how convenient it is to reason about iteration expressed 
in this form.) The third says that if a "drives" towards t without passing it, provided P remains 
true, then eventually a* will either make P false somewhere on the way to z, or it will reach z. 
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Example proof 

The following program was devised by Manna and Pnueli [16] to illustrate the efficacy of 
their method of proving termination. 

Y .* = 0? 

whi le X £ do 

(while X t do (X := X-lj Y : = Y+D? 
Y s= Y-l? 
while Y i do (Y := Y-l; X := X+D) 

This program represents an obscure way of setting both X and Y to 0, namely by first 
setting Y to 0, then copying X into Y by repeatedly decrementing X and incrementing Y, then 
decrementing Y once, then copying Y back into X by repeatedly decrementing Y and incrementing 
X. This process is repeated until X becomes 0. The point of this example was that it was 
supposed to be difficult to prove termination of this program by Floyd's method but easy by the 
method described by Manna and Pnueli. Our own interest in this program besides the question of 
ease of proving termination (not a problem in dynamic logic) is that it is just the right size to 
illustrate the proof techniques appropriate to dynamic logic. 

We may write this program in the programming language dynamic logic caters for thus. 

PI i X>0?| Xi«X-l;Y:«Y+l. 

P2s Y>0?; Ys=Y-l; X:»X+1. 

P3s X>0?| PI*? X=0?; Ys*Y-l; P2*; Y*0?. 

P4: Ys=0$ P3*; X*0?. 

PI represents one step of "copying" a number from X to Y, while P2 represents one step of 
copying from Y to X. P1*;X=0? and P2*;Y=0? each represent the entire copying process, from X 
to Y and back again. P3 amounts to a program that, provided Y is initially 0, decrements X. P4 is 
then the whole program for setting X and Y to 0. The statement we want to prove is, <P4>t (t 
denotes true), which asserts that it is possible for P4 to hall. The following is the proof, which 
uses 7 hypotheses from arithmetic and 13 theorems. This proof is machine-readable. 

% The Manna-Pnue I i program % 

Pis X>0?; Xs=X-l; Yi«Y+l. 

P2: Y>0?? Y:*Y-1» X:*X+1. 

P3s X>0?| P1*| X*0?i Ys=Y-l; P2*; Y=0?. 
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P4: Y:=Oj P3*; X=0?. 

% Formulae occurring commonly in the proof % 
Ax(n): X=nAY=0. Bx(m,n): X=nAX+Y=m. 

Ay(n): Y=nAX=0. By(m,n): Y=nAX+Y=m. 

X Assumptions from arithmetic - not proved here X 
HI: Z=n+1 s Z-l=n. H2: U=n+1 d U>0. 

H3: Ax(n) s Bx(n,n). H4: Ay(n) = By(n,n). 
H5: Ax(n) s By(n,0). H6: Ay(n) = Bx(n,0). 
H7: W=U. 

Thml: Bx(m,n+1) o <Pl>Bx(m,n). 

ShoM Thml <pAr o <s?>(pAr)> using H2 <pds>. 

Thm2: By(m,n+1) o <P2>By(m,n). 

Show Thm2 {pAr o <s?>(pAr)> using H2 <pos>. 

Thm3: Bx(m,n) :> <Pl*>Bx(m,0) . 
Use Convergence (n) Thm3 from Thml. 

Thm4: By(m,n) d <P2*>By(m,0) . 
Use Convergence (n) Thm4 from Thm2. 

ThmS: Ax(n) z> <Pl*>Ay(n). 
Show Thm5 {pxa>q> 

using Thm3 <pxa>q}. 

ThmG: Ax(n+1) d <Pl*>Ay(n+l) . 
Show ThmG -Cp> using Thm3 <p>. 

Thm7s Ay(n) d <P2*>Ax(n). 
Show Thm7 -CrD<a>s> 

using Thm4 CpD<a>q>, H4 <rsp>, H5 < 9 sq}. 

Thm8t Ay(n+1) d <Y: =Y-l>Ay(n) . 

Show Thm8 <pAr o qAr> using HI <p=q>. 
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ThmSs Ax(n-fl) o <P3>Ax(n). 

Show Thm9 -CxnlAyO d <xp?;a;xO?;dy$b?yO?>(><nAyO)> 
using H2 -CxnlDxp}, 

ThmG <xnlAyO d <a> (ynlAxO)>, 

Thm7 {yriAxO d <b> (xrv\yO)>, 

Thm8 -CynlAxO d <dy>(yriAxO)>. 

ThmlO: Ax(n) d <P3*>Ax(0). 

Use Performance(n) ThmlO from Thm9* 

Thmlli X-nD^t -0>(X=rv\Yc:0K 
Show Thmll {pDpAq} using H7 <q>. 

Thml2s X=*nD<P4>t. 

Show Thml2 <p3<a?cir?>t> 

using ThmlO <pAqD<o(rAq)>, Thmll {pxa>(pAq)}, 

Thml3s <P4>t. 

Show Thml3 <p> using Thml2 <qDp>,, H7 {q>. 

To avoid being distracted by extraneous issues such as arithmetic truth we have introduced 
all arithmetic facts in this proof as assumptions. (In fact, in the implemented system we have a 
very fast proof-checker for quantifier-free Presburger arithmetic, using quasi-Gaussian 
elimination.) 

The above proof is not the largest proof we have successfully checked with our system. A 
substantial part of a total correctness proof of the Knuth-IVIorris-Pratt pattern-matching 
algorithm has been machine-checked, and we are in the process of completing this proof. This 
extends work on the partial correctness of this algorithm by Wegbreit [241 

Discussion of the proof-checker 

We have constructed a system for checking proofs of the kind exemplified above. In this we 
are following in the footsteps of Milner [20,21,26], who is doing for Scott's Logic of Computable 
Functions what we are doing for the above modal extension to first-order logic. Inasmuch as we 
are treating programs that manipulate their environments, we are also continuing a tradition of 
several years of implementing systems for proving and checking proofs of properties of programs 
[4 s 8jl3,14 ? 23,241 However the greater expressive power of dynamic logic compared to that of 
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partial correctness assertions (the language used in almost all such systems) adds considerably to 
the interest of our system. This consideration actually makes Milner's system a closer relative 
of ours than the partial correctness systems, due to the greater emphasis on "expressions as 
first class citizens" in Milner's system and ours, resulting in a logic where programs and facts 
mingle more Treely than say with Hoare's notation. The major difference between Milner's 
system and ours is the LCF treatment of programs (computable functions) as individuals in the 
underlying domain versus our treatment of programs as "adverbs," analogously to quantifiers. 
Another system related to ours is Richard Weyhrauch's [1,25] FOL (First-Order Logic) proof- 
checker. A detail in which our program differs from Milner's and Weyhrauch's (apart Trom the 
obvious one of choice of logical language) is that our program makes less of an effort to help the 
user interactively than is done by either LCF or FOL, but rather is, at least thus far, a system in 
which the user prepares his proof exactly as though he were writing a program. This means that 
his proof exists on a Hie and is read by the proof-checker just as an interpreter reads a program 
from a file. This has permitted us to focus all of our effort on the proof-checker proper. 

The proof-checker is implemented on the PDP-10 computer at M.I.T.'s Artificial Intelligence 
Laboratory. The program written to date has aproximately 100 LISP functions comprising a total 
of 1800 lines of code averaging 4 LISP atoms per line. The bulk of this code is for formula 
manipulation. However, a small amount of it is for book-keeping tasks of a relatively minor 
nature associated with keeping track of the structure of a proof. 

Directions for further research 

Although our immediate goals may not appear to be particularly ambitious or difficult to 
achieve, as well as not being obviously "Artificial Intelligence" research, we admit to far more 
ambitious and less plausible objectives on a larger time scale. Ultimately we see the proof- 
checker itself becoming a component of a variety of very intelligent program-manipulating 
programs. This depends on our belief that the ability to check proofs is a vital part of any 
program that pretends to "understand" some domain of discourse where the discussion is at all 
involved. Two applications that we would like to explore when the proof-checker has reached a 
satisfactory level of performance are (i) the automatic production or reliable software and (ii) 
machine-mediated reasoning about programs. Our plan of attack for each of these areas is not 
presently so crisp that we would feel confident embarking on either area forthwith, particularly 
the second, but we can nevertheless at this early stage present thoughts on these subjects. 

The notion of program reliability through correctness proofs has gained momentum in the 
past few years, spurred on most notably by the axiomatic methods of Floyd [73 and Hoare [111 
As yet there is not a shred of hard evidence to suggest that this approach supplies the most 
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economical approach to reliability (where the economics takes into account both the cost of 
having unreliable software and the total programming and maintenance cost). Indeed, it may well 
turn out that the bulk of the problems encountered today with unreliable software may be 
disposed of by a happy combination of a good programming language and a clean programming 
style- Nevertheless, if the proof-oriented approach can be made to work and does not put too 
great a burden on the programmer and/or the computer, it may provide reliable software at low 
cost. We feel it is well worth continuing the experiments that have been going on in this area in 
the past few years. Although these experiments have not thus far demonstrated the value of 
correctness proofs, it is still too early to draw any negative conclusions about the method in 
general 

From a longer-range viewpoint, the burden of programming should become progressively 
more the computer's responsibility, requiring the computer to "understand" better the programs 
it executes. This has been the trend since the first assembler was used, and though the trend is 
perhaps not as pronounced as some have hoped, there is no doubt that the trend continues. As it 
does, methods of reasoning about programs will concomitantly become a more essential part of 
the computer's repertoire. This raises the question of the choice of language most appropriate to 
such reasoning. In view of the expressive power of dynamic logic we feel that it is worth 
developing the methodology of reasoning in this language with an eye to automating the reasoning 
as far as possible. A program like our proof-checker is precisely what is needed in the way of a 
"black box" that ''accepts" a reasonably sized step in a discussion about a program. The sort of 
machine-mediated discussions we envisage could quite well be cast as proofs, albeit in the form 
of a dialogue. If the notion of a dialogue as a proof seems strange, visualize a conversation - 
about a program - punctuated with "I don't see why you need that test there" and "How do you 
guarantee that X will never become negative?" Such conversations about programs arise all the 
time, and it is clear that the questions are referring to proofs, probably expressed informally but 
proofs nonetheless. One might argue that proof-checking is not understanding, but we would 
insist that it is at least a component of understanding. 

As humans are taken progressively further out of the loop (admittedly a very long-range 
view) the dialogue will become more of a monologue. However it may still be appropriate for the 
computer to reason about the programs it is contemplating using a language like dynamic logic. 
Thus even in this scenario the basic proof-checking methodology may continue to be used. We 
should add that we see nothing strange in the idea of a computer checking proofs that it 
generated itself; the best way to generate proofs may be to propose possibly faulty proofs and 
subject them to detailed criticism. This would require not only the error-detecting capability of 
our proposed proof-checker but error-correcting capability as w«fll. 
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